Documentation

Revo Treasury is an AI-assisted treasury console on Arc mainnet (chain 5042). Each operator wallet owns a private treasury. Arcus, the treasury agent, turns natural-language strategy into validated proposals, and every mutation passes through security controls before it touches state.

The system has three planes:

• ›Identity plane. Wallet-signature authentication; a session binds you to exactly one treasury.
• ›Decision plane. Commands, proposals, policies, and approvals: the human-plus-agent workflow.
• ›Settlement plane. Per-treasury custody wallets that move USDC on-chain for deposits, withdrawals, and Uniswap v4 swaps.

Access takes three steps and roughly a minute:

• ›01: Connect a wallet. Any injected browser wallet is detected automatically (EIP-6963). No extension-specific setup.
• ›02: Switch to Arc. The console offers the network switch (chain 5042) if your wallet is elsewhere.
• ›03: Verify ownership. Sign a one-time message. The signature proves control of the address; it costs no gas and authorizes no transfers.

Arcus accepts plain-language input in two forms:

• ›Commands, "rotate 20% of idle USDC into staked yield," are compiled into structured proposals with allocation math, risk framing, and guardrail checks. Nothing executes without passing the approval workflow.
• ›Questions, "what is our current drawdown exposure?", are answered from live treasury context: balances, mode, policies, and recent activity.

Agent traffic is rate-limited and bounded. Responses are informational tooling, not financial advice; the Risk Disclaimer covers the model's limits.

A proposal is the unit of change: a target allocation with rationale, generated by Arcus or by policy. Proposals move through a strict lifecycle: pending review, approved and executed, or rejected with a recorded reason.

• ›Approve/reject actions are atomic: concurrent decisions on the same proposal cannot double-execute.
• ›Execution settles the rebalance as a real swap on Arc through Uniswap v4: quoted, checked with an eth_call before signing, signed by the custody key, broadcast, and confirmed from the receipt. The realised fill is written to the activity record.
• ›Every decision lands in the tamper-evident audit log with the acting wallet.

Policies are standing rules compiled from natural language, for example, drawdown limits or allocation ceilings. A policy moves through draft → active states, can be rejected at review, and is marked superseded when a newer policy replaces it. Active policies feed the agent's proposal generation and the platform's monitoring jobs.

The mode dial sets how much latitude the agent has:

Each treasury has a dedicated deposit address on Arc, shown in the console's wallet panel.

• ›Deposit. Send USDC on Arc to your treasury address, then submit the transaction hash. The transfer is verified against the Arc RPC before being credited; a hash can only ever be credited once, to one treasury.
• ›Withdraw. Request a withdrawal to the depositing wallet and sign a time-limited authorization message (valid for five minutes). The treasury sends the transfer on-chain; a reconciliation job resolves any transfer interrupted mid-flight.
• ›Limits. Per-withdrawal and daily caps apply, configurable in the security panel within platform bounds.

• ›Emergency pause. Blocks withdrawals, approvals and autonomous execution instantly, and pins the mode to Safe until an admin lifts it. State transitions are serialized so a pause cannot race an execution.
• ›Withdrawal caps. Per-transaction and rolling daily limits enforced inside the database transaction that moves funds.
• ›Audit trail. Privileged actions are recorded in a hash-chained log; retroactive edits are detectable.
• ›Risk drills. A drill simulates an emergency rotation against your real balances so you can rehearse operator response. Drills require a funded treasury; the platform never fabricates numbers for an empty one.
• ›Alerts. Drawdown breaches and operational anomalies surface in the console's alert stream.

The console is built on a JSON HTTP API rooted at /api. Authentication is a wallet-signature exchange that sets an HTTP-only session cookie; all treasury routes are scoped to the authenticated operator's treasury; the tenant is never taken from client input.

Mutating routes enforce role permissions (administrator, strategist, approver, guardian) and return conventional status codes: 401 unauthenticated, 403 insufficient role, 409 state conflict.